hfsplus: fix 32-bit integer overflow in statfs()

Commit Message

Mikael Heino Feb. 28, 2025, 9:41 a.m. UTC

Very large volumes (20TB) would cause an integer overflow in statfs()
and display incorrect block counts.

Statfs structure's f_blocks, f_bfree and f_bavail are stored as a u64,
but the promotion to 64-bit happens after the shift has been done.
Fix this issue by promoting the value before shifting.

The problem can be reproduced by creating a 20TB volume for HFS+,
mounting and running statfs() on the mounted volume.

Cc: [e-mail]
Cc: [e-mail]
Reviewed-by: Anton Altaparmakov <[e-mail]>
Signed-off-by: Mikael Heino <[e-mail]>
---
 fs/hfsplus/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch

diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 948b8aaee33e..00bb23b0ff7d 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -322,8 +322,8 @@  static int hfsplus_statfs(struct dentry *dentry, struct kstatfs *buf)
 
 	buf->f_type = HFSPLUS_SUPER_MAGIC;
 	buf->f_bsize = sb->s_blocksize;
-	buf->f_blocks = sbi->total_blocks << sbi->fs_shift;
-	buf->f_bfree = sbi->free_blocks << sbi->fs_shift;
+	buf->f_blocks = (u64)sbi->total_blocks << sbi->fs_shift;
+	buf->f_bfree = (u64)sbi->free_blocks << sbi->fs_shift;
 	buf->f_bavail = buf->f_bfree;
 	buf->f_files = 0xFFFFFFFF;
 	buf->f_ffree = 0xFFFFFFFF - sbi->next_cnid;